update to test authorized keys

Author: JacobBarthelmeh

.github/workflows/windows-cert-store-test.yml

@@ -230,6 +230,40 @@ jobs:
         Write-Host "Client cert thumbprint: $($clientCert.Thumbprint)"
         Add-Content -Path $env:GITHUB_ENV -Value "CLIENT_CERT_SUBJECT=$($clientCert.Subject)"
 
+    - name: Create Windows user testuser and authorized_keys
+      shell: pwsh
+      run: |
+        $homeDir = "C:\Users\testuser"
+        $authKeysFile = "$homeDir\authorized_keys_test"
+        
+        # Create home dir (profile) for testuser
+        New-Item -ItemType Directory -Path $homeDir -Force | Out-Null
+        Write-Host "Created $homeDir"
+        
+        # Create or update local user testuser with that home (needed for pubkey S4U and SFTP GetHomeDirectory)
+        $u = Get-LocalUser -Name "testuser" -ErrorAction SilentlyContinue
+        if ($u) {
+          Write-Host "User testuser already exists"
+        } else {
+          New-LocalUser -Name "testuser" -Password (ConvertTo-SecureString "TestPass123!" -AsPlainText -Force) -FullName "Test User" -Description "CI" -PasswordNeverExpires -ErrorAction Stop
+          Write-Host "Created user testuser"
+        }
+        # Set home to our directory (some GetHomeDirectory implementations use profile; ensure it exists)
+        Set-LocalUser -Name "testuser" -HomeDirectory $homeDir -ErrorAction SilentlyContinue
+        
+        # authorized_keys: hansel public key with comment 'testuser'
+        $pubKey = Get-Content "${{ github.workspace }}\wolfssh\keys\hansel-key-ecc.pub" -Raw
+        if (-not $pubKey) {
+          Write-Host "ERROR: hansel-key-ecc.pub not found"
+          exit 1
+        }
+        $pubKey = ($pubKey -replace '\s+hansel\s*$', ' testuser').TrimEnd()
+        $pubKey | Out-File -FilePath $authKeysFile -Encoding ASCII -NoNewline
+        # ensure testuser can read (wolfsshd impersonates testuser when checking authorized_keys)
+        icacls $authKeysFile /grant "testuser:R" /q
+        Write-Host "Created $authKeysFile"
+        Get-Content $authKeysFile
+
     - name: Create wolfSSHd config file
       working-directory: ${{ github.workspace }}\wolfssh
       shell: pwsh
@@ -240,6 +274,12 @@ jobs:
         PermitRootLogin yes
         "@
         
+        # AuthorizedKeysFile: relative to user home (e.g. C:\Users\testuser/authorized_keys_test)
+        $configContent += @"
+
+        AuthorizedKeysFile authorized_keys_test
+        "@
+        
         if ("${{ matrix.server_key_source }}" -eq "store") {
             # Get server cert subject from environment
             $serverSubject = (Get-Content env:SERVER_CERT_SUBJECT)
@@ -731,8 +771,7 @@ jobs:
             $errOut = Get-Content sftp_error.txt -Raw
         }
         
-        # Success indicators: connection established, key exchange completed
-        # Failure indicators: connection refused, key exchange failed
+        # Failure indicators
         if ($output -match "connection.*refused" -or $errOut -match "connection.*refused") {
             Write-Host "ERROR: Connection refused - server may not be running"
             exit 1
@@ -741,8 +780,16 @@ jobs:
             Write-Host "ERROR: Key exchange failed - cert store key may not be working"
             exit 1
         }
+        if ($output -match "Couldn't connect" -or $errOut -match "Couldn't connect") {
+            Write-Host "ERROR: SFTP could not connect (check authorized_keys, user, or server)"
+            exit 1
+        }
+        if ($process.ExitCode -ne 0) {
+            Write-Host "ERROR: SFTP client exited with code $($process.ExitCode)"
+            exit 1
+        }
         
-        Write-Host "Test completed - key exchange appears to have worked"
+        Write-Host "Test completed - key exchange and SFTP connection succeeded"
 
     - name: Test SSH client connection
       working-directory: ${{ github.workspace }}\wolfssh